EUVD-2026-73552
GHSA-hx69-939j-r82m
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-reachable AD CS endpoint, low complexity, any domain account (PR:L), no confidentiality or availability impact - integrity-only tampering.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Incomplete list of disallowed inputs in Active Directory Certificate Services (AD CS) allows an authorized attacker to perform tampering over a network.
AnalysisAI
Tampering in Active Directory Certificate Services (AD CS) allows a low-privileged, authenticated network attacker to manipulate certificate issuance or PKI configuration by supplying inputs that bypass an incomplete deny list. Affected Windows Server versions span 2012 through 2025, as well as Windows 10 builds relying on AD CS. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a valid, low-privilege Active Directory account (PR:L confirmed by CVSS vector) with network access to an AD CS enrollment endpoint - no elevated permissions, no special role, and no user interaction required. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N places this at a base score of 6.5, reflecting a network-reachable, low-complexity attack requiring only a low-privilege domain account - no user interaction or elevated rights needed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft security update released for this vulnerability, targeting the specific build floor for each affected OS: Windows Server 2025 to build 10.0.26100.33438 or later, Windows Server 2022 to 10.0.20348.5622 or later, Windows Server 2019 to 10.0.17763.9245 or later, Windows Server 2016 to 10.0.14393.9512 or later, Windows Server 2012 R2 to 6.3.9600.23397 or later, and Windows Server 2012 to 6.2.9200.26349 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allShare
External POC / Exploit Code
Leaving vuln.today